BCM5354 (Asus WL500GPv2) DMA RX buffer too small and skb_over_panic

[Hauke Mehrtens]

Hi Rafał,

I got some bug reports [0] in OpenWrt regarding a kernel panic because
of b43. It occurs on BCM5354 devices, when they are in AP mode.

There was also a discussion about this on this mailing list some years
ago. [1]

It happens after some time ( 3h to 2d ) without any load or anything not
normal, in station mode this panic does not occur.
After the error occurred the CPU usage increases to 3.0 - 5.0
Sometimes "b43-phy0 ERROR: MAC suspend failed" is shown in the log
before this panic.

Rafał could you please have a look at the issue?

------
Hauke

[0]: https://dev.openwrt.org/ticket/9459
[1]: http://permalink.gmane.org/gmane.linux.drivers.bcm54xx.devel/10682



Kernel panic:

b43-phy0: Loading firmware version 410.2160 (2007-05-26 15:32:10)
b43-phy0: Loading firmware version 410.2160 (2007-05-26 15:32:10)
......
b43-phy0 ERROR: DMA RX buffer too small (len: 42390, buffer: 2352,
nr-dropped: 19)
b43-phy0 ERROR: DMA RX buffer too small (len: 25505, buffer: 2352,
nr-dropped: 11)
b43-phy0 ERROR: DMA RX buffer too small (len: 19022, buffer: 2352,
nr-dropped: 9)
b43-phy0 ERROR: DMA RX buffer too small (len: 4189, buffer: 2352,
nr-dropped: 2)
b43-phy0 ERROR: DMA RX buffer too small (len: 37381, buffer: 2352,
nr-dropped: 16)
skb_over_panic: text:80c9a408 len:2378 put:2378 head:80eef000
data:80eef040 tail:0x80eef98a end:0x80eef980 dev:<NULL>
Kernel bug detected[#1]:
Cpu 0
$ 0   : 00000000 1000b800 0000007c 00000001
$ 4   : 80293498 000020ed ffffffff 000020ed
$ 8   : 00004000 00000000 00000001 ffffffff
$12   : 0000000f 80253c78 ffffffff 00000000
$16   : 00eef040 0000092c 80eef040 819e0740
$20   : 81b3cb00 0000001e a1b4a1e0 80c9f978
$24   : 00000002 80166250
$28   : 81a46000 81a47db0 00000020 801a3d24
Hi    : 00000000
Lo    : 00000077
epc   : 801a3d24 0x801a3d24
    Not tainted
ra    : 801a3d24 0x801a3d24
Status: 1000b803    KERNEL EXL IE
Cause : 00800024
PrId  : 00029029 (Broadcom BCM3302)
Modules linked in: xt_IMQ nf_nat_tftp nf_conntrack_tftp nf_nat_irc
nf_conntrack_irc nf_nat_ftp nf_conntrack_ftp xt_HL xt_hl xt_MARK ipt_ECN
xt_CLASSIFY xt_time xt_tcpmss xt_statistic xt_mark xt_length ipt_ecn
xt_DSCP xt_dscp xt_string xt_layer7 ipt_MASQUERADE iptable_nat nf_nat
xt_CONNMARK xt_recent xt_helper xt_conntrack xt_connmark xt_connbytes
xt_NOTRACK iptable_raw xt_state nf_conntrack_ipv4 nf_defrag_ipv4
nf_conntrack pppoe pppox ipt_REJECT xt_TCPMSS ipt_LOG xt_comment
xt_multiport xt_mac xt_limit iptable_mangle iptable_filter ip_tables
xt_tcpudp x_tables ppp_async ppp_generic slhc b43legacy sch_red b43
sch_sfq sch_hfsc cls_fw imq mac80211 ts_fsm ts_bm ts_kmp crc_ccitt
cfg80211 compat_firmware_class compat arc4 aes_generic deflate ecb cbc
switch_robo switch_core diag
Process irq/5-b43 (pid: 895, threadinfo=81a46000, task=81ab45d0,
tls=00000000)
Stack : 00000000 80c9a408 0000094a 0000094a 80eef000 80eef040 80eef98a
80eef980
        8026e09c 0000001e a1b4a1e0 80c9a408 80c17ad4 00ff0000 000000e6
00010000
        819e2400 819e2400 80d31568 00ff0000 80c9f978 00010000 00010000
819e2400
        00008000 00010000 81b3ca24 00010000 802ce8c0 00000000 802953b4
80c872cc
        00010000 802ce8c0 80292f28 8001ce0c 819ea138 819ea138 80292f28
8001eba0
        ...
Call Trace:[<80c9a408>] 0x80c9a408
[<80c9a408>] 0x80c9a408
[<80c872cc>] 0x80c872cc
[<8001ce0c>] 0x8001ce0c
[<8001eba0>] 0x8001eba0
[<8001cef8>] 0x8001cef8
[<80190bf4>] 0x80190bf4
[<80c87424>] 0x80c87424
[<80057480>] 0x80057480
[<8000af98>] 0x8000af98
[<80057304>] 0x80057304
[<80057304>] 0x80057304
[<8003db30>] 0x8003db30
[<8000f86c>] 0x8000f86c
[<8003dab4>] 0x8003dab4
[<8000f85c>] 0x8000f85c


Code: afab001c  0c0028ff  afa20020 <0200000d> 08068f4a  00000000
8fbf002c  01201021  03e00008
Disabling lock debugging due to kernel taint
exiting task "irq/5-b43" (895) is an active IRQ thread (irq 5)


Call Trace from an other report:

Jan  1 04:03:40 OpenWrt user.warn kernel: Call Trace:
Jan  1 04:03:40 OpenWrt user.warn kernel: [<8019bc10>] skb_put+0x74/0x90
Jan  1 04:03:40 OpenWrt user.warn kernel: [<8051a3e8>]
b43_dma_rx+0x294/0x378 [b43]
Jan  1 04:03:40 OpenWrt user.warn kernel: [<805072b8>]
b43_controller_restart+0x7a8/0x97c [b43]
Jan  1 04:03:40 OpenWrt user.warn kernel: Code: afab001c  0c0028c2
afa20020 <0200000d> 08066f05  00000000  8fbf002c  01201021  03e00008
Jan  1 04:03:40 OpenWrt user.warn kernel: Disabling lock debugging due
to kernel taint
Jan  1 04:03:40 OpenWrt user.err kernel: exiting task "irq/5-b43" (763)
is an active IRQ thread (irq 5)